Securing Windows Networks

Identify and classify physical assets to determine criticality, then implement layered access controls to protect servers, networks, and data from unauthorized physical access.

Develop and enforce enterprise policies, standards, procedures, and guidelines to secure Windows networks, update them regularly, and actively involve users at all levels to ensure consistent security.

Empower employees as the frontline defense for securing Windows networks with a focused security awareness program that defines protected data and teaches social engineering defense.

Evolve security strategies as threats change; there is no silver bullet or single device guaranteeing protection. Educate users, regularly update policies, and test patches to address emerging threats.

Discover how Windows architecture divides into kernel mode and user mode, with hardware abstraction layer, kernel mode drivers, microkernel, and executive components, to protect hardware access and security.

Understand Active Directory, a hierarchical database of network objects with LDAP-based queries and replication across domain controllers. Grasp Kerberos, a mutual authentication protocol that verifies client and server identities.

Identify users through Kerberos-based authentication in Active Directory, control access via authorization, and audit activities with Windows Event Viewer security logs.

Examine how Active Directory structures Windows domains and enables security through domain services, certificate services, federation services, and lightweight directory services.

Explore the essentials of Active Directory design, including domains, trees, and forests, and how domain boundaries, trusts, and group policy shape secure, scalable Windows networks.

Apply the least privilege principle using Active Directory groups to manage permissions for users and computers. Learn about group scopes: machine local, domain local, global, and universal.

learn how to organize users into domain local, global, and universal groups, and apply permissions to those groups using the agdlp structure to simplify managing large enterprise access.

Learn how to implement AGDLP in Windows networks by using a sales global group to grant access via domain local groups, simplifying permissions and onboarding.

Demonstrate managing users and groups with the Active Directory users and computers console, including creating users and groups, assigning passwords, and applying domain local, global, and universal group permissions.

Permissions define access to specific objects granted to users or groups, with group-based assignment recommended; rights define actions in Active Directory like backups, take ownership, or log on interactively.

Balance effective settings with consistent application to secure Windows networks using Group Policy. Use the Group Policy Management Console to create and link a GPO across sites, domains, and OUs.

Explore how to configure group policy across Active Directory by linking GPOs to organizational units, applying login-based settings, and refreshing policy updates for consistent security.

Configure group policy with the local policy editor and group policy management console, create and copy GPOs, and use modeling, backup, and reports for enterprise-wide consistency.

Understand how user account policies secure networks via group policy in Active Directory, and learn to configure password policies, account lockout, and Kerberos settings.

Set a minimum password length in group policy to strengthen authentication with longer, complex passwords using upper and lower case, digits, and symbols, balancing security with usability.

Learn to manage Windows user accounts by using Active Directory, security principals, and SIDs; disable instead of delete, set logon hours, and regularly verify accounts to prevent rogue access.

Set logon hours in Active Directory to restrict when users can log in, adding a security layer against stolen credentials; configure hours per user or in bulk.

Delegation of authentication uses Kerberos to let an application reuse user credentials across servers, enabling end-to-end identity and single sign-on via Active Directory.

Explore delegation of authorization in Active Directory using service principal names (SPN) to enable Kerberos authentication, including adding an SPN to a user account and configuring delegation.

Discover how authentication delegation evolved in Windows networks, from all-or-nothing to constrained delegation across domains within Active Directory. Learn to identify and configure server principal names for secure cross-domain access.

Learn to configure delegation for a user in Windows Server 2012 by mapping a service principal name and managing delegation via Active Directory Users and Computers.

Enable read-only domain controllers to bolster security in remote offices by hosting a read-only Active Directory copy, forwarding changes to writable domain controllers, and caching credentials without outward replication.

Apply the principle of least privilege to build a multi-layer security plan that restricts access to what users need and denies unauthorized access.

Explore how Windows authenticates users with a username and shared secret against securely stored Active Directory data, then issues a security access token with user and group IDs.

Explore how user account control prompts for administrative permissions, showing the program name and verified publisher, and how elevation lets standard accounts perform admin tasks without compromising security.

Explore the evolution of user account control (UAC) from Vista to Windows 7 and 8.1, and compare four settings: always notify, notify me only, dim desktop, never notify.

Learn how to configure UAC on Windows Server 2012, including never notify, group policy, registry edits, and local security policy adjustments to manage elevation prompts and avoid repeated prompts.

Explore Kerberos, a MIT-originated authentication protocol used in Windows domains. Kerberos issues tickets, including the ticket granting ticket, to enable mutual authentication and prevent replay attacks.

Note that NTLM, the network translation land manager, appears in legacy scenarios when Kerberos cannot be used. Prioritize Kerberos for security, but NTLM remains in workgroups or restricted environments.

Explore how discretionary access control lists identify allowed and denied users and groups, and how the security access token is checked against the DACL in an Active Directory Kerberos environment.

Protect local data by encrypting data at rest across devices, servers, and laptops, using TPM, the encrypting file system, and BitLocker to shield information from local and network access.

Explore how encryption protects data by turning plain text into ciphertext using keys. Compare symmetric and asymmetric encryption, noting speed, security, and the importance of key backups.

Understand how the trusted platform module stores and wraps encryption keys, seals them to platform measurements, and prevents data access if a device is stolen or tampered with.

Learn to initialize and manage the trusted platform module with the TPM.mse tool, enable TPM in BIOS, take ownership with a password, and protect encryption keys.

Learn how the Encrypting File System (EFS) provides transparent, file system level encryption for files and folders on NTFS, using keys and certificates, and why backing up keys is critical.

Enable the encrypting file system on a folder in windows server 2012 to secure data at rest. Observe how files transparently encrypt and decrypt on access, protected by your password.

Back up the efs encryption keys and certificates using the certificate manager. Export the private key with the certificate and store the backup securely on removable media for recovery.

Learn how BitLocker drive encryption protects data at rest by encrypting entire Windows volumes, integrates with TPM for key protection, and supports recovery modes and optional startup authentication.

Configure two partitions: an unencrypted system volume for pre-start up authentication, and a separate encrypted operating system or data volume, to enable BitLocker with or without TPM.

Explore BitLocker modes with TPM: TPM only, TPM and pin, TPM and startup key, and TPM and smart cards certificate, plus recovery mode and recovery keys and passwords.

Manage BitLocker on servers and desktops, initialize TPM in BIOS, partition disks, and enable drive encryption; deploy via Server Manager, Control Panel, Explorer, and policy-driven tools.

Enable network unlock to automatically decrypt BitLocker volumes at startup on wired corporate networks, easing management for Windows 8 and Server 2012 clients.

Explore how BitLocker To Go protects removable drives by creating a virtual volume encrypted with a key stored on the USB.

Explore PKI as the foundation for securing data in transit using asymmetric encryption. See how a certificate authority verifies identities and binds a public key to a user via certificates.

Explore the core elements of a Microsoft PKI, including root CA, subordinate CA, registration authority, certificate database, certificate store, and key archival server, and how certificates are issued and revoked.

Learn to install and configure Active Directory Certificate Services to build a public key infrastructure, enabling certificate-based authentication, digital signatures, and secure key management in Windows networks.

Explore the nitty gritty of certificate services, including ca roles, root and subordinate certificates, revocation, web enrollment, online responder, and device enrollment to secure a pki with Active Directory.

Understand how certificate authorities create a hierarchical public key infrastructure. Learn why root and subordinate CAs, offline key protection, and third-party verification shape trust across internal and external networks.

Explore how a root CA delegates trust to subordinate CAs within a PKI, the role of an offline root, and the risks of private key compromise affecting certificates and traffic.

Learn how to design a PKI with Windows Server 2012 by choosing enterprise root CA, enterprise subordinate CA, standalone root CA, and standalone subordinate CA, and their interactions.

learn how windows file sharing and ntfs permissions work together to secure data, and use auditing and volume shadow copy service to track access and restore earlier file versions.

Learn to manage file shares using Computer Management, Explorer, and Server Manager in Windows environments, understand shares, sessions, open files, and align NTFS and share permissions across versions.

Explore administrative shares, their role as hidden default shares like C$, D$, and E$, and how they enable remote administrator access while balancing security and system stability.

Explore administrative shares security and best practices for Windows networks, including remote administration, renaming the administrator account, using a strong decoy with no permissions, and limiting access.

Disable admin shares by editing the registry to prevent recreation on restart, but test thoroughly and weigh security risks before applying in production environments.

Learn how share and NTFS permissions stack in Windows networks, and apply best practices by grouping users, avoiding individual permissions, and granting authenticated users read access.

Special permissions provide granular NTFS control beyond basic permissions, accessible via the advanced button, defining rights like traverse, read data, create files, delete, and take ownership.

Explore special permissions to apply least privilege and tailor security; learn to delete sub folders and files, delete permissions, read and change permissions, and take ownership.

Explore the Windows registry, the binary, hierarchical database that stores the system state and settings. Learn to back up and restore the registry to guard against malicious or accidental changes.

secure registry utilities by tightly controlling access to the registry editor and reg command tools in System32, and review permissions via the security tab to prevent intrusions.

Explore registry permissions in Windows, focusing on the two root keys local machine and users. Learn to add groups or users and set permissions with caution, testing in non-production environments.

Learn to enable and tailor registry auditing using group policy and advanced audit policy configurations, including global object access auditing, to monitor registry key activity and permissions.

Define server roles to harden the network by clearly specifying each machine’s purpose and required services, then design-focused hardening and disable unnecessary features.

Learn to use server manager to configure server roles and features, monitor status and events, manage services and user accounts, and access tools like event viewer and group policy.

Reduce the attack surface by disabling unnecessary features like graphical interfaces and dot net, and run essential services such as DNS and DHCP using server core for security.

Windows Server 2012 server core reduces attack surface by running minimal services without a graphical user interface, now supporting 13 server roles and enabling switch back to graphical user interface.

AppLocker blocks unapproved software using rules based on file attributes such as publisher and path, managed via local or group policy, with an audit mode for testing.

Discover how Windows firewall with advanced security protects networks by default, using stateful rules, port controls, and built-in protection in client and server editions.

Explore the Windows firewall basics and advanced settings across domain, private, and public networks. Learn to create inbound rules for programs or ports and use predefined services.

Explore Windows firewall with advanced security in Server 2012, introducing IKEv2 end-to-end security interoperability, Windows Store app network isolation, and PowerShell commands to configure IPsec and firewall rules.